================================================================== BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv read-write to 0xffff88813845bf80 of 4 bytes by interrupt on cpu 0: can_can_gw_rcv+0x863/0x870 net/can/gw.c:572 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc3/0x480 net/can/af_can.c:602 can_receive+0x13e/0x190 net/can/af_can.c:674 can_rcv+0x17d/0x1f0 net/can/af_can.c:699 __netif_receive_skb_one_core net/core/dev.c:6209 [inline] __netif_receive_skb net/core/dev.c:6322 [inline] process_backlog+0x363/0x670 net/core/dev.c:6673 __napi_poll+0x61/0x300 net/core/dev.c:7737 napi_poll net/core/dev.c:7800 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7957 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:196 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:214 spin_unlock_bh include/linux/spinlock.h:396 [inline] release_sock+0x10c/0x180 net/core/sock.c:3825 j1939_sk_sendmsg+0xac4/0xc00 net/can/j1939/socket.c:1298 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752 __sys_sendmmsg+0x185/0x320 net/socket.c:2841 __do_sys_sendmmsg net/socket.c:2868 [inline] __se_sys_sendmmsg net/socket.c:2865 [inline] __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2865 x64_sys_call+0x27aa/0x3020 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read-write to 0xffff88813845bf80 of 4 bytes by interrupt on cpu 1: can_can_gw_rcv+0x863/0x870 net/can/gw.c:572 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc3/0x480 net/can/af_can.c:602 can_receive+0x13e/0x190 net/can/af_can.c:674 can_rcv+0x17d/0x1f0 net/can/af_can.c:699 __netif_receive_skb_one_core net/core/dev.c:6209 [inline] __netif_receive_skb net/core/dev.c:6322 [inline] process_backlog+0x363/0x670 net/core/dev.c:6673 __napi_poll+0x61/0x300 net/core/dev.c:7737 napi_poll net/core/dev.c:7800 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7957 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] __alloc_skb+0x658/0x690 net/core/skbuff.c:697 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0x7d/0x470 net/core/skbuff.c:6734 sock_alloc_send_pskb+0x44d/0x500 net/core/sock.c:2998 unix_dgram_sendmsg+0x391/0x1050 net/unix/af_unix.c:2131 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] __sys_sendto+0x42e/0x490 net/socket.c:2265 __do_sys_sendto net/socket.c:2272 [inline] __se_sys_sendto net/socket.c:2268 [inline] __x64_sys_sendto+0x76/0x90 net/socket.c:2268 x64_sys_call+0x2d35/0x3020 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x000108a4 -> 0x000108a5 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 2989 Comm: klogd Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 ================================================================== ================================================================== BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv read-write to 0xffff88813845bf80 of 4 bytes by interrupt on cpu 0: can_can_gw_rcv+0x863/0x870 net/can/gw.c:572 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc3/0x480 net/can/af_can.c:602 can_receive+0x13e/0x190 net/can/af_can.c:674 can_rcv+0x17d/0x1f0 net/can/af_can.c:699 __netif_receive_skb_one_core net/core/dev.c:6209 [inline] __netif_receive_skb net/core/dev.c:6322 [inline] process_backlog+0x363/0x670 net/core/dev.c:6673 __napi_poll+0x61/0x300 net/core/dev.c:7737 napi_poll net/core/dev.c:7800 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7957 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:196 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:214 spin_unlock_bh include/linux/spinlock.h:396 [inline] j1939_session_list_unlock net/can/j1939/transport.c:244 [inline] j1939_session_activate+0x1d3/0x220 net/can/j1939/transport.c:1603 j1939_sk_send_loop net/can/j1939/socket.c:1181 [inline] j1939_sk_sendmsg+0x890/0xc00 net/can/j1939/socket.c:1295 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752 __sys_sendmmsg+0x185/0x320 net/socket.c:2841 __do_sys_sendmmsg net/socket.c:2868 [inline] __se_sys_sendmmsg net/socket.c:2865 [inline] __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2865 x64_sys_call+0x27aa/0x3020 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read-write to 0xffff88813845bf80 of 4 bytes by interrupt on cpu 1: can_can_gw_rcv+0x863/0x870 net/can/gw.c:572 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc3/0x480 net/can/af_can.c:602 can_receive+0x13e/0x190 net/can/af_can.c:674 can_rcv+0x17d/0x1f0 net/can/af_can.c:699 __netif_receive_skb_one_core net/core/dev.c:6209 [inline] __netif_receive_skb net/core/dev.c:6322 [inline] process_backlog+0x363/0x670 net/core/dev.c:6673 __napi_poll+0x61/0x300 net/core/dev.c:7737 napi_poll net/core/dev.c:7800 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7957 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x42/0xd0 kernel/softirq.c:735 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline] sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1061 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 finish_task_switch+0x132/0x320 kernel/sched/core.c:5239 context_switch kernel/sched/core.c:5385 [inline] __schedule+0x936/0xd20 kernel/sched/core.c:7183 preempt_schedule_irq+0x2d/0x50 kernel/sched/core.c:7507 raw_irqentry_exit_cond_resched+0x4b/0x60 kernel/entry/common.c:142 irqentry_exit_to_kernel_mode_preempt+0x2b/0x40 include/linux/irq-entry-common.h:476 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline] irqentry_exit+0x7d/0x5b0 kernel/entry/common.c:164 sysvec_apic_timer_interrupt+0x44/0x80 arch/x86/kernel/apic/apic.c:1061 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 __sanitizer_cov_trace_pc+0x5c/0x70 kernel/kcov.c:233 avtab_node_cmp security/selinux/ss/avtab.c:75 [inline] avtab_search_node+0x275/0x2b0 security/selinux/ss/avtab.c:156 context_struct_compute_av+0x343/0xaf0 security/selinux/ss/services.c:664 security_compute_av+0x34f/0xa20 security/selinux/ss/services.c:1177 avc_compute_av+0x5d/0x430 security/selinux/avc.c:992 avc_perm_nonode+0x5e/0xe0 security/selinux/avc.c:1117 avc_has_perm_noaudit+0xf2/0x130 security/selinux/avc.c:1160 cred_has_capability+0x121/0x2a0 security/selinux/hooks.c:1666 selinux_capable+0x31/0x40 security/selinux/hooks.c:2189 security_capable+0x7b/0x90 security/security.c:660 ns_capable_common kernel/capability.c:342 [inline] ns_capable+0x4c/0xb0 kernel/capability.c:363 bpf_ns_capable kernel/bpf/token.c:14 [inline] bpf_token_capable+0x42/0xd0 kernel/bpf/token.c:23 bpf_prog_load+0xb8e/0x1140 kernel/bpf/syscall.c:2934 __sys_bpf+0x505/0x7e0 kernel/bpf/syscall.c:6252 __do_sys_bpf kernel/bpf/syscall.c:6365 [inline] __se_sys_bpf kernel/bpf/syscall.c:6363 [inline] __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6363 x64_sys_call+0x10cb/0x3020 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x000566b9 -> 0x000566ba Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 10981 Comm: syz.0.2136 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 ==================================================================